Ask the question: Is the cost of giving the user a new generated password higher than the risk averted by storing the password hashed.
If all you have is a login for a website, then the risk is clearly bigger than any cost.
Ask the question: Is the cost of giving the user a new generated password higher than the risk averted by storing the password hashed.
If all you have is a login for a website, then the risk is clearly bigger than any cost.
Name one.
A website has educational content. Teachers can sign up students in their classrooms. The teacher's password is stored securely, the student's password is not. The student password is shorter and automatically generated. The goal is to make the password just hard enough to not be guessed by other students, but not so hard that the student can't remember it. It is stored in clear text so that the teacher can look it up for the student, or print out the password to pass out to the student, etc. The student account is only given access to the content. The worst thing that happens if a student's password is guessed is that another student can mess up their progress tracking.
Is there a reason the student passwords should be encrypted in the database?